summaryrefslogtreecommitdiff
path: root/pkg
Commit message (Collapse)AuthorAge
* Set systemd mode if entrypoint begins with /bin/sh -cDaniel J Walsh2022-03-30
| | | | | | Fixes: https://github.com/containers/podman/issues/13324 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Switch all calls to filepath.Walk to filepath.WalkDirDaniel J Walsh2022-03-30
| | | | | | | | | WalkDir should be faster the Walk, since we often do not need to stat files. [NO NEW TESTS NEEDED] Existing tests should find errors. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* add contextDir to tar on remotecdoern2022-03-30
| | | | | | | | | | podman build fails on remote build when using a relative context directory. This is because the context dir was not being added to the tar, so when remote the compat build function would not be able to stat the contextDir. resolves #13293 Signed-off-by: cdoern <cbdoer23@g.holycross.edu>
* fix podman machine start log level detectionPaul Holzinger2022-03-30
| | | | | | | Use logrus.IsLevelEnabled because this will cover all levels below it as well. Currently this condition would fail for the trace log level. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* podman machine start: lookup qemu path again if not foundPaul Holzinger2022-03-30
| | | | | | | | | | | | | | | We store the full path to qemu in the machine config. When the path changes on the host the machine can longer be started. To fix it we get the path again when we fail to start the machine due the missing binary. We want to store and use the full path first because otherwise existing machines can break when the qemu version changed. [NO NEW TESTS NEEDED] We still have no machine tests. Fixes #13394 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* play: kube: use in-memory kubefile and remove tempfileChristian Stewart2022-03-30
| | | | | | | | | | | | | | | | | | | | | The PlayKube and PlayKubeDown commands accepted a "path" argument to a YAML file to play. This requires the caller to write the YAML to a file path. The downside of this is apparent in the HTTP handlers which have to use a temporary file on disk to store the YAML file. The file is opened & used as the body of the HTTP request. It's possible to instead pass a io.Reader and use a fully in-memory request body. Add backwards-compatible changes to bindings to allow passing either a filepath or a io.Reader body. Refactor the podman bindings to use a io.Reader instead of a filepath. Simplify the HTTP handlers for PlayKube by removing the now unneeded tempfile. [NO NEW TESTS NEEDED] Signed-off-by: Christian Stewart <christian@paral.in>
* podman stats: calc CPU percentage correctlyPaul Holzinger2022-03-30
| | | | | | | | | | | | | | | | | | | | | When you run podman stats, the first interval always shows the wrong cpu usage. To calculate cpu percentage we get the cpu time from the cgroup and compare this against the system time between two stats. Since the first time we do not have a previous stats an empty struct is used instead. Thus we do not use the actual running time of the container but the current unix timestamp (time since Jan 1 1970). To fix this we make sure that the previous stats time is set to the container start time, when it is empty. [NO NEW TESTS NEEDED] No idea how I could create a test which would have a predictable cpu usage. See the linked bugzilla for a reproducer. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2066145 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Explicitly use IPv4 to check if podman-machine VM is listeningBurt Holzman2022-03-30
| | | | | | | | | | | | | | | | When starting a VM that has been configured with volume mounts, the podman client attempts to connect via TCP to localhost, which runs gvproxy to proxy an ephemeral port to the VM's ssh port. Previously, gvproxy was listening on all interfaces and IP addresses, but this behavior has changed to listening only on the IPv4 loopback address. Without this change, if a newer build of gvproxy is used, a podman machine configured with volume mounts will hang forever after "podman machine start" with "Waiting for VM ...". [NO NEW TESTS NEEDED] Signed-off-by: Burt Holzman <burt@fnal.gov>
* podman create: building local pause image: do not read ignore filesValentin Rothberg2022-03-30
| | | | | | | | | Make sure to ignore local {container,docker}ignore files when building a local pause image. Otherwise, we may mistakenly not be able to copy catatonit into the build container. Fixes: #13529 Signed-off-by: Valentin Rothberg <vrothberg@redhat.com>
* Separator is no longer prepended when prefix is empty on podman generate systemdNirmal Patel2022-03-30
| | | | | | | | | | | | | | When podman generate systemd is invoked, it previously did not check if container-prefix or pod-prefix are empty. When these are empty, the file name starts with the separator, which is hyphen by default. This results in files like '-containername.service'. The code now checks if these prefixes are empty. If they are, the filename no longer adds a separator. Instead, it uses name or ID of the container or pod. Closes #13272 Signed-off-by: Nirmal Patel <npate012@gmail.com>
* Fixes TTY & resizing on Mac and WindowsJason T. Greene2022-03-30
| | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Fixes: #13301 ("machine rm removes the mounted socket file on macos")Thibault Gagnaux2022-03-30
| | | | | [NO NEW TESTS NEEDED] Signed-off-by: Thibault Gagnaux <tgagnaux@gmail.com>
* Throw an error if kube yaml has duplicate ctr namesUrvashi Mohnani2022-03-30
| | | | | | | Error out if the kube yaml passed to play kube has more than one container or init container with the same name. Signed-off-by: Urvashi Mohnani <umohnani@redhat.com>
* do not set the inheritable capabilitiesGiuseppe Scrivano2022-03-30
| | | | | | | | | | The kernel never sets the inheritable capabilities for a process, they are only set by userspace. Emulate the same behavior. Closes: CVE-2022-27649 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> (cherry picked from commit aafa80918a245edcbdaceb1191d749570f1872d0)
* Handle incompatible machinesJason T. Greene2022-03-18
| | | | | | Start in a reduced mode for recovery, warn, and provide instructions to recreate them Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* machine rm -f stops and removes machineBrent Baude2022-03-18
| | | | | | | | | | | | If you want to remove a running machine, you can now pass the --force/-f to podman machine rm and the machine will be stopped and removed without confirmations. Fixes: #13448 [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* Improve agent install message to add restart instructionsJason T. Greene2022-03-18
| | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* MacOS improvementsBrent Baude2022-03-18
| | | | | | | | * Enable support of virtfs in Podman and darwin. At the time of this writing, it requires a special patch not yet included in upstream qemu. * Prefer to use a specially built qemu to support virtfs. The qemu is installed under libexec/podman. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* [v4.0] Backport Set default rule at the head of dev configtomsweeneyredhat2022-03-10
| | | | | | | | | | | | | | | | | | | Backports: #13421 Set default rule at the head of device configuration by @hshiina The default rule should be set at the head of device configuration. Otherwise, rules for user devices are overridden by the default rule so that any access to the user devices are denied. This has been requested to backport and to include in RHEL 8.6 and 9.0. The exception process is underway. Addresses these BZs for the backport: https://bugzilla.redhat.com/show_bug.cgi?id=2059296 https://bugzilla.redhat.com/show_bug.cgi?id=2062835 Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
* Revert "use GetRuntimeDir() from c/common"Brent Baude2022-03-01
| | | | | | | | This reverts commit fc5cf812c81a10f8a021aae11df5f12ab2a6f6f6. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* use GetRuntimeDir() from c/commonPaul Holzinger2022-02-23
| | | | | | | | | To prevent duplication and potential bugs we should use the same GetRuntimeDir function that is used in c/common. [NO NEW TESTS NEEDED] Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* kube: honor --build=false and make --build=true by defaultAditya R2022-02-23
| | | | | | | | `podman play kube` tries to build images even if `--build` is set to false so lets honor that and make `--build` , `true` by default so it matches the original behviour. Signed-off-by: Aditya R <arajan@redhat.com>
* kube: honor mount propagation modeGiuseppe Scrivano2022-02-23
| | | | | | | convert the propagation mode specified for the mount to the expected Linux mount option. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
* Fix lintMatthew Heon2022-02-17
| | | | Signed-off-by: Matthew Heon <matthew.heon@pm.me>
* Fix manifest 4.0 EndpointsJhon Honce2022-02-17
| | | | | | Branch forced 4.0 only endpoints Signed-off-by: Jhon Honce <jhonce@redhat.com>
* Introduce podman machine init --root=t|f and podman machine set --root=t|fJason T. Greene2022-02-16
| | | | | | Switch default to rootless for mac and windows Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Initial implementation of mac forwarding using a privileged docker sock ↵Jason T. Greene2022-02-16
| | | | | | claim helper Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* ignition: propagate proxy settings from a host into a vmesendjer2022-02-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Set proxy settings (such as `HTTP_PROXY`, and others) for the whole guest OS with setting up `DefaultEnvironment` with a `systemd` configuration file `default-env.conf`, a `profile.d` scenario file - `default-env.sh` and a `environment.d` configuration file `default-env.conf` The **actual** environment variables are read by podman at a start, then they are encrypted with base64 into a single string and after are provided into a VM through QEMU Firmware Configuration (fw_cfg) Device Inside a VM a systemd service `envset-fwcfg.service` reads the providead encrypted string from fw_cfg, decrypts and then adds to the files - `/etc/systemd/system.conf.d/default-env.conf` - `/etc/profile.d/default-env.sh` - `/etc/environment.d/default-env.conf` At the end this service execute `systemctl daemon-reload` to propagate new variables for systemd manager [NO NEW TESTS NEEDED] Closes #13168 Signed-off-by: esendjer <esendjer@gmail.com>
* Update to podman4 copr streamJason T. Greene2022-02-16
| | | | Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
* Fix checkpoint/restore pod testsAdrian Reber2022-02-16
| | | | | | | | | Checkpoint/restore pod tests are not running with an older runc and now that runc 1.1.0 appears in the repositories it was detected that the tests were failing. This was not detected in CI as CI was not using runc 1.1.0 yet. Signed-off-by: Adrian Reber <areber@redhat.com>
* Make sure building with relative paths work correctly.Daniel J Walsh2022-02-16
| | | | | | Fixes: https://github.com/containers/podman/issues/12763 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Add 409 response to swagger godocJhon Honce2022-02-16
| | | | | | | | | When attempting to create a network with a name that already exists, a 409 status code will be returned [NO NEW TESTS NEEDED] Signed-off-by: Jhon Honce <jhonce@redhat.com>
* Temporarily pull machine images from side repoBrent Baude2022-02-14
| | | | | | | | | | | Until podman4 is in the fcos trees, we need to pull the machine images from a side repository. There is a hard coded bit that forces the side repo download right now. Simple comment or removal of the bit will revert to normal download behavior. [NO NEW TESTS NEEDED] Signed-off-by: Brent Baude <bbaude@redhat.com>
* [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.Tom Deseyn2022-02-10
| | | | Signed-off-by: Tom Deseyn <tom.deseyn@gmail.com>
* compat: endpoint /build must set header content type as application/json in ↵Aditya R2022-02-10
| | | | | | | | | | | | | | reponse Lot of clients are expecting proper `Content-type: application/json` configured in response headers of `/build` compat api. Following commit fixes that. Fixes issues where code is setting header field after writing header which is wrong. We must set `content-type` before we write and flush http header. Signed-off-by: Aditya R <arajan@redhat.com>
* Podman pod create --share-parent vs --share=cgroupcdoern2022-02-10
| | | | | | | | | | | | | | separated cgroupNS sharing from setting the pod as the cgroup parent, made a new flag --share-parent which sets the pod as the cgroup parent for all containers entering the pod remove cgroup from the default kernel namespaces since we want the same default behavior as before which is just the cgroup parent. resolves #12765 Signed-off-by: cdoern <cdoern@redhat.com> Signed-off-by: cdoern <cbdoer23@g.holycross.edu> Signed-off-by: cdoern <cdoern@redhat.com>
* Add version guard to libpod API endpointsJhon Honce2022-02-09
| | | | | | | | | * Ensure meaningful behaviour when called with /v3.x.x semantics * Change return code to 409 from 500 when client attempts to use an existing network name * Update API bats test runner to support /v4.0.0 endpoints by default Signed-off-by: Jhon Honce <jhonce@redhat.com>
* idmap should be able to be specified along with other optionsDaniel J Walsh2022-02-09
| | | | | | | | [NO NEW TESTS NEEDED] crun is not available everywhere to test idmap. Kernel might not be recent enough and not all file systems support idmap option. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Revert "Move each search dns to its own line"Paul Holzinger2022-02-03
| | | | | | | | | | This reverts commit a1bc8cb52cefd49e8cc54ae14d1864b8a1ec216e. Please see resolv.conf(5) search domains must be on the same line. If you use multiple seach key words only the last one is used. I tested this with alpine and it works correctly when they are on the same line so I am not sure what issues Dan had with it but this is not correct. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Move each search dns to its own lineDaniel J Walsh2022-02-03
| | | | | | | | | | Alpine does not seem to use search correctly when there are multiple search domains on the same line. It only uses the first with the advent. When podman runs within a separate network we are appending on dns.podman as a search, if you add a search domain, then this causes the local search on network to fail. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix size to match Docker selectionDaniel J Walsh2022-02-03
| | | | | | Fixes: https://github.com/containers/podman/issues/13096 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* Fix use of infra image to clarify defaultDaniel J Walsh2022-02-03
| | | | Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
* ignition, machine: delegate cpu,io cgroup controllers to machine's default usersAditya R2022-02-03
| | | | | | | | | | | | | | | | Makes sure that ignition setups up systemd config so cgroup controllers like `cpu, io` are also delegated to `non-root` along with `memory, pid`. This allows general users of `podman` on `macOS` and `podman-remote` to do operations which are dependent on `cpu, io` cgroup controllers. [NO TESTS NEEDED] [NO NEW TESTS NEEDED] We don't have a CI infra to test this, please pull the tree and run `podman info` inside the machine to confirm. Signed-off-by: Aditya R <arajan@redhat.com>
* pkg/bindings/images.Build(): slashify "dockerfile" values, tooNalin Dahyabhai2022-02-03
| | | | | | | | | | | When the Dockerfile isn't in the root directory of the build context, the client supplies its pathname to the server, but it needs to do so using "/" as the path separator, not the client OS's path separator. CI can't test Windows clients, so [NO NEW TESTS NEEDED] Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
* Merge pull request #12712 from flouthoc/volume_overlay_advancedOpenShift Merge Robot2022-01-28
|\ | | | | volume: add support for non-volatile `upperdir`,`workdir` for overlay volumes
| * volume: add support for non-volatile upperdir,workdir for overlay volumesAditya Rajan2022-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Often users want their overlayed volumes to be `non-volatile` in nature that means that same `upper` dir can be re-used by one or more containers but overall of nature of volumes still have to be `overlay` so work done is still on a overlay not on the actual volume. Following PR adds support for more advanced options i.e custom `workdir` and `upperdir` for overlayed volumes. So that users can re-use `workdir` and `upperdir` across new containers as well. Usage ```console $ podman run -it -v myvol:/data:O,upperdir=/path/persistant/upper,workdir=/path/persistant/work alpine sh ``` Signed-off-by: Aditya R <arajan@redhat.com>
* | network create: allow multiple subnetsPaul Holzinger2022-01-27
|/ | | | | | | | | | | podman network create --subnet, --gateway and --ip-range can now be specified multiple times to join the network to more than one subnet. This is very useful if you want to use a dual stack network and assign a fixed ipv4 and ipv6 subnet. The order of the options is important here, the first --gateway/--ip-range will be assigned to the first subnet and so on. Signed-off-by: Paul Holzinger <pholzing@redhat.com>
* Merge pull request #12867 from cdoern/scpOpenShift Merge Robot2022-01-27
|\ | | | | switch podman image scp from depending on machinectl to just os/exec
| * switch podman image scp from depending on machinectl to just os/execcdoern2022-01-26
| | | | | | | | | | | | | | | | | | machinectl does not propogate error messages and adds extra lines in the output, exec.Cmd is able to clear the env besides PATH and TERM, and use the given UID and GID to execute the command properly. machinectl is still used to create a user session. Ubuntu support is limited by this. Signed-off-by: cdoern <cdoern@redhat.com>
* | rootless: drop permission check for devicesGiuseppe Scrivano2022-01-27
|/ | | | | | | | | | | | | commit 350ede1eeb6ab33bce2918d7768b940c255e63c6 added the feature. Do not check whether the device is usable by the rootless user before adding to the container. Closes: https://github.com/containers/podman/issues/12704 [NO NEW TESTS NEEDED] it requires changes on the host to test it Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-02-06 20:10:34 +0000